chore(build): add gitleaks secret scanning workflow

[sklarsa]

Summary

• Adds a Gitleaks GitHub Actions workflow to scan for secrets on pull requests and pushes to the default branch
• Uses gitleaks/gitleaks-action@v2 with GITLEAKS_LICENSE secret

Reference: questdb/questdb#6863

Summary by CodeRabbit

• Chores
  • Added automated security scanning to the repository's continuous integration pipeline.

[coderabbitai]

Warning

Rate limit exceeded

@sklarsa has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 52 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 19 minutes and 52 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: de900b71-60ca-436d-8f7b-fcdf052ee59d

📥 Commits

Reviewing files that changed from the base of the PR and between 51d261d and 21de04a.

📒 Files selected for processing (1)

• .github/workflows/gitleaks.yml

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow file that implements gitleaks secret scanning. The workflow runs on pull requests and pushes to main, checking out the repository and executing the gitleaks-action with necessary credentials passed from GitHub secrets.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow .github/workflows/gitleaks.yml	New workflow for automated secret scanning using gitleaks-action@v2, triggered on pull requests and pushes to main, with environment variable configuration for GITHUB_TOKEN and GITLEAKS_LICENSE.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A workflow so keen, with secrets to screen,
Gitleaks guards each pull with care,
No hidden gems in commits we've seen,
Our repo stays pure and fair! 🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore(build): add gitleaks secret scanning workflow' accurately describes the main change—adding a new GitHub Actions workflow for secret scanning with Gitleaks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-gitleaks-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/gitleaks.yml (1)

13-16: Pin action references to immutable SHAs.

Using @v4 and @v2 leaves the workflow trusting movable tags. Pinning both actions to full commit SHAs hardens the workflow against upstream tag retargeting.

Hardening example

-      - uses: actions/checkout@v4
+      - uses: actions/checkout@<full-length-commit-sha>
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@<full-length-commit-sha>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gitleaks.yml around lines 13 - 16, The workflow currently
references movable tags "uses: actions/checkout@v4" and "uses:
gitleaks/gitleaks-action@v2"; replace those with the corresponding immutable
commit SHAs for the actions (e.g., actions/checkout@<full-commit-sha> and
gitleaks/gitleaks-action@<full-commit-sha>) by looking up the commit SHA in each
action's GitHub repo and updating the uses entries so the workflow pins to the
exact commit rather than a tag.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/gitleaks.yml:
- Line 4: The Gitleaks job is failing for forked PRs because
secrets.GITLEAKS_LICENSE is unavailable; update the workflow triggered by
pull_request to guard the job (e.g., the gitleaks job) with a conditional that
detects forks (use github.event.pull_request.head.repo.fork or
github.repository_owner != github.actor) and skip running when true, or
implement a non-licensed fallback path that avoids referencing
secrets.GITLEAKS_LICENSE for forked PRs; modify the job definition that
currently runs on pull_request to check this condition before accessing
secrets.GITLEAKS_LICENSE so external PRs do not fail.

---

Nitpick comments:
In @.github/workflows/gitleaks.yml:
- Around line 13-16: The workflow currently references movable tags "uses:
actions/checkout@v4" and "uses: gitleaks/gitleaks-action@v2"; replace those with
the corresponding immutable commit SHAs for the actions (e.g.,
actions/checkout@<full-commit-sha> and
gitleaks/gitleaks-action@<full-commit-sha>) by looking up the commit SHA in each
action's GitHub repo and updating the uses entries so the workflow pins to the
exact commit rather than a tag.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 02b2f9fe-30aa-40c5-8c8f-56e02414f731

📥 Commits

Reviewing files that changed from the base of the PR and between 437382b and 51d261d.

📒 Files selected for processing (1)

• .github/workflows/gitleaks.yml